OESA-2026-4654: freerdp security update
FreeRDP is a client implementation of the Remote Desktop Protocol (RDP) that follows Microsoft's open specifications. This package provides the client applications xfreerdp. Security Fix(es):
FreeRDP versions before 3.31.0 contain a heap buffer overflow vulnerability in negosendnegotiationrequest() that fails to validate the LBLOADBALANCEINFO field length before writing to a fixed 512-byte buffer. A malicious RDP server or man-in-the-middle can send a Server Redirection PDU with an oversized LBLOADBALANCEINFO value to overflow the buffer with attacker-controlled content, causing denial of service or heap corruption before authentication completes.(CVE-2026-91953)
FreeRDP before 3.31.0 contains an out-of-bounds read vulnerability in the URBDRC channel's funcgetepdesc function that indexes interface arrays by position instead of protocol field InterfaceNumber. A malicious RDP server can send a crafted SELECTCONFIGURATION message with permuted InterfaceNumber values to read past allocated heap memory and crash the client.(CVE-2026-91956)
FreeRDP is an implementation of the Remote Desktop Protocol (RDP) open sourced by the FreeRDP team. FreeRDP versions before 3.31.0 have a buffer error vulnerability. This vulnerability originates from buffer over-reading in the rtsreadresult function in the RPC gateway transport parser. An attacker can trigger an out-of-bounds read by sending a specially crafted BINDACK PDU with truncated result entries, causing the process to terminate.(CVE-2026-91959)
FreeRDP versions before 3.31.0 contain an uninitialized heap memory disclosure vulnerability in the urbdrc USB redirection channel. A malicious RDP server can induce failing USB transfers to read uninitialized heap memory from the client, defeating ASLR and enabling remote code execution when chained with memory corruption vulnerabilities.(CVE-2026-91963)
FreeRDP versions before 3.31.0 contain a heap-based buffer overflow in negosendnegotiationrequest when processing Server Redirection PDU messages with attacker-controlled LoadBalanceInfo fields. A malicious RDP server can trigger the overflow by sending an arbitrary-length field that gets written to a fixed 512-byte buffer without validation, causing client crashes or potential code execution when chained with memory disclosure.(CVE-2026-91964)
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
openeuler/freerdpto a version that resolves this vulnerability.Fixed in 2.11.8-11.oe2403sp1 - Upgrade
Upgrade
FreeRDPto a version that resolves this vulnerability.Fixed in 3.31.0
Event History
Child vulnerabilities
Contains the following vulnerabilities.
Frequently Asked Questions
Which systems are exposed to these issues?
Systems using the FreeRDP client applications, including xfreerdp, are exposed when they connect to a malicious RDP server. The affected FreeRDP versions are those before 3.31.0.
Does exploitation require valid RDP credentials or prior authentication?
No. The heap buffer overflow associated with a malicious Server Redirection PDU can occur before authentication completes. The out-of-bounds read can be triggered by a malicious RDP server sending a crafted URBDRC SELECT_CONFIGURATION message.
What could an attacker achieve?
The LB_LOAD_BALANCE_INFO length-validation flaw can cause denial of service or heap corruption using attacker-controlled content. The URBDRC interface-number handling flaw can read beyond allocated heap memory and crash the client.
What should be prioritized if an update cannot be applied immediately?
Avoid connecting affected FreeRDP clients to untrusted RDP servers, since exploitation requires a malicious server or, for the redirection issue, a man-in-the-middle capable of modifying RDP traffic. Treat unexpected client crashes during RDP connections as a potential indicator of attempted exploitation.